RE: [dss-comment] Public Comment - timestamp & RC 3161

["Nick Pope" <pope@secstan.com>]

Inma,

Thank you for raising this question on the DSS timestamp and RFC 3161.

As you noted the <dss:TstInfo> element was based upon the RFC 3161 stucture.
Some elements of the RFC 3161 fields were not included as the functionality
is covered elsewhere in the DSS protocol:

1) The nonce is optional in RFC 3161.  Its use allows the client to
prevent replay attacks.   DSS is designed to be used over a security binding
which prevents replay.  The serial number already provides for unqiueness.

2) Message imprint is not included as it is in the XML DSig <ds:reference>
and this allowing greater flexibility in the object being timestamped.

3) The version is identified through the XML Namespace.

4) The <dss:Timestamp> element is extensible by adding additional elements
within the <ds:object> element within the <ds:signature> forming the
<dss:timestamp>

5) <ErrorBound> is equivalent to Accuracy

Nick Pope
co-chair OASIS DSS